PT-2023-14936 · Harbor · Harbor

Published 2023-01-12 · Updated 2025-11-15 · CVE-2022-46463

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Harbor versions 1.X.X through 2.5.3

Description An access control issue allows attackers to access public and private image repositories without authentication. The vendor states this behavior is documented as a feature. There is no information about the number of potentially affected devices worldwide or any real-world incidents where this issue was exploited. The issue involves accessing repositories without proper authorization.

Recommendations For Harbor versions 1.X.X through 2.5.3, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

BIT-HARBOR-2022-46463

CVE-2022-46463

Affected Products

Harbor

References · 17

• 🔥 https://github.com/404tk/CVE-2022-46463 · Exploit
• 🔥 https://github.com/nu0l/CVE-2022-46463 · Exploit
• 🔥 https://github.com/CodeSecurityTeam/harbor · Exploit
• 🔥❌ https://github.com/wh-gov/CVE-2022-46463 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2022-46463 · Security Note
• https://osv.dev/vulnerability/CVE-2022-46463 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-harbor-2022-46463 · Vendor Advisory
• https://t.me/cvenotify/42305 · Telegram Post
• https://github.com/Vad1mo · Note
• https://t.me/cvenotify/118199 · Telegram Post
• https://twitter.com/dailycve/status/1948463142574461332 · Twitter Post
• ❌ https://github.com/lanqingaa/123/blob/main/README.md · Note, Deleted
• https://t.me/cvenotify/41885 · Telegram Post
• https://t.me/proxy_bar/1301 · Telegram Post
• https://t.me/cvenotify/88792 · Telegram Post